CVE-2020-37120
Published: 05 February 2026
Summary
CVE-2020-37120 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of untrusted inputs like the DICOM server name field to prevent buffer overflows that enable SEH overwrite and arbitrary code execution.
Implements memory protection mechanisms such as DEP and ASLR to block exploitation of buffer overflows via SEH overwrite even if input validation fails.
Mandates timely identification, reporting, and correction of flaws like this buffer overflow vulnerability in the Rubo DICOM Viewer.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow with SEH overwrite enables remote arbitrary code execution without authentication or user interaction, directly mapping to exploitation of a public-facing or network-accessible application.
NVD Description
Rubo DICOM Viewer 2.0 contains a buffer overflow vulnerability in the DICOM server name input field that allows attackers to overwrite Structured Exception Handler (SEH). Attackers can craft a malicious text file with carefully constructed payload to execute arbitrary code…
more
by overwriting SEH and triggering remote code execution.
Deeper analysisAI
CVE-2020-37120 is a buffer overflow vulnerability in Rubo DICOM Viewer 2.0, affecting the DICOM server name input field. The flaw enables attackers to overwrite the Structured Exception Handler (SEH), as detailed in the CVE description and classified under CWE-121. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.
Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction by crafting a malicious text file with a carefully constructed payload. Triggering the buffer overflow overwrites SEH, allowing arbitrary code execution on the target system running the affected DICOM viewer.
Advisories and references, including an archived Rubo Medical product page, an Exploit-DB entry (48351) providing a proof-of-concept exploit, and a VulnCheck advisory on the Rubo DICOM Viewer buffer overflow SEH issue, document the vulnerability but do not specify patches or mitigations in the available details.
Details
- CWE(s)